What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Virus? Maybe.

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
When i try and login to my account, about half of the time it will stick me at the loading screen after i type in my information. When this happens i just reboot and it usually works the second time. After I'm in it will run okay for maybe a minute or two, sometimes longer, sometimes shorter then things will begin to just completely freeze up. Once in a while I can't open anything as soon as i get in.

Heres what HijackThis got.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:41:03 PM, on 5/17/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16766)
Boot mode: Safe mode with network support

Running processes:
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\Desktop\HiJackThis (1).exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z045&form=ZGAPHP
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\PROGRA~1\ALWILS~1\Avast5\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
O2 - BHO: Somoto Toolbar - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files (x86)\free-downloads.net\tbfree.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Client\YontooIEClient.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files (x86)\free-downloads.net\tbfree.dll
O3 - Toolbar: Somoto Toolbar - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\PROGRA~1\ALWILS~1\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Application Virtualization Client (sftlist) - Unknown owner - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
O23 - Service: Application Virtualization Service Agent (sftvsa) - Unknown owner - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12407 bytes
Post #2
Hello and Posted Image

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:
  • Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
  • Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
  • Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!



It would appear that you have more than one anti-virus solution on your machine. I can see both Avast and AVG installed.
Having more than one anti-virus program on your machine, even if only one is running, can cause conflicts and slowdowns in the performance of the machine.
Before continuing on, please completely uninstall one of the programs. The easiest way to do this is to visit one of these pages and use one of the removal tools listed below:
AVG Removal Tool
Avast Uninstall Utility



HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.




Download and Run DDS by sUBs

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and choose Run as Administrator dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Save both reports to your desktop.
—————————————————

Please Please copy / paste the scan reults.

DDS.txt

Please attach the second file; Attach.txt.



Also, please let me know if there is improvement in how your machine is running after removing one of the anti-virus programs.
Post #3
After removing AVG it seems to be running fine, thanks so much. Here are my scan results. . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 21:58:22.77 on Wed 05/18/2011 Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4095.2453 [GMT -5:00] . AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\SysWOW64\PnkBstrB.exe C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Steam\Steam.exe C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files\Alwil Software\Avast5\AvastUI.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\conhost.exe C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\wuauclt.exe C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\taskeng.exe C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Adam\Downloads\dds (1).scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bing.com/?pc=Z045&form=ZGAPHP uInternet Settings,ProxyOverride = *.local mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll mURLSearchHooks: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files (x86)\free-downloads.net\tbfree.dll mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\PROGRA~1\ALWILS~1\Avast5\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll BHO: Somoto Toolbar: {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files (x86)\free-downloads.net\tbfree.dll BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - C:\Program Files (x86)\Yontoo Layers Client\YontooIEClient.dll TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll TB: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files (x86)\free-downloads.net\tbfree.dll TB: Somoto Toolbar: {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\PROGRA~1\ALWILS~1\Avast5\aswWebRepIE.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [Google Update] "C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll LSP: C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File TB-X64: {ECDEE021-0D17-467F-A1FF-C7A115230949} - No File . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/?pc=Z045&form=ZGAPHP FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll FF - component: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\extensions\{b9d63c58-90cc-428b-8d3b-cbb88eb07e7e}\components\RadioWMPCoreGecko19.dll FF - component: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll FF - component: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\extensions\{ecdee021-0d17-467f-a1ff-c7a115230949}\components\FFExternalAlert.dll FF - component: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\extensions\{ecdee021-0d17-467f-a1ff-c7a115230949}\components\RadioWMPCore.dll FF - component: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\peqksk7d.default\extensions\[removed]\components\RadioWMPCoreGecko19.dll FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Adam\AppData\Local\Google\Update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Conduit Engine : [removed] - %profile%\extensions\[removed] FF - Ext: Elf 1.15 Community Toolbar: {b9d63c58-90cc-428b-8d3b-cbb88eb07e7e} - %profile%\extensions\{b9d63c58-90cc-428b-8d3b-cbb88eb07e7e} FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} FF - Ext: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - %profile%\extensions\{ecdee021-0d17-467f-a1ff-c7a115230949} FF - Ext: Yontoo Layers: [removed] - %profile%\extensions\[removed] FF - Ext: avast! WebRep: [removed] - C:\PROGRA~1\ALWILS~1\Avast5\WebRep\FF FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - C:\Program Files (x86)\AVG\AVG10\Firefox4 . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-3-13 505176] R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-1-1 280408] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-9-28 203776] R2 AntiVirMailService;Avira AntiVir MailGuard;C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [2011-5-1 339624] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-5-1 136360] R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-5-1 269480] R2 AntiVirWebService;Avira AntiVir WebGuard;C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe [2011-5-1 421032] R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-1-1 22360] R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-1-1 64344] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-3-13 42184] R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2011-5-1 83120] R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-3-28 2111368] R2 StarWindServiceAE;StarWind AE Service;C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-1-26 9085952] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-1-26 299520] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2010-8-16 116240] R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2010-4-24 721768] R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2010-4-24 269672] R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2010-4-24 22376] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2010-9-1 1222144] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664] S2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-4-24 483688] S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-1-17 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-9-3 227232] S3 NMgamingmsFltr;USB Optical Mouse;C:\Windows\System32\drivers\NMgamingms.sys [2009-7-24 11264] S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-6-10 187392] S3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2010-4-24 25960] S3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-4-24 209768] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-2-18 51712] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-1-2 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2011-05-19 02:19:21 ——– d—–w- C:\Users\Adam\AppData\Local\{AA776671-01D6-45A1-86D3-6C22E0EC0739} 2011-05-18 21:56:40 ——– d—–w- C:\Users\Adam\AppData\Local\ElevatedDiagnostics 2011-05-18 21:33:41 ——– d—–w- C:\Users\Adam\AppData\Local\{2AD10F1E-3940-4395-A663-0F23623A30E2} 2011-05-18 21:01:15 ——– d—–w- C:\d3ca2b9dfcc3e9f20c607a9e 2011-05-18 20:57:35 ——– d—–w- C:\Users\Adam\AppData\Local\{B0455D5E-FB3C-40DB-B171-10F51A58C420} 2011-05-17 21:50:07 ——– d—–w- C:\Users\Adam\AppData\Local\{0EBC881E-5D15-40B2-A048-DEFEF450E1B7} 2011-05-16 22:33:30 ——– d—–w- C:\Users\Adam\AppData\Local\{12965A66-4D76-41C9-853F-0C14E238AD14} 2011-05-16 21:57:45 ——– d—–w- C:\Users\Adam\AppData\Local\{CB2F0837-4D5D-45F0-AD6E-F1A39FAA1542} 2011-05-16 21:12:52 ——– d—–w- C:\Users\Adam\AppData\Local\{8469C9A5-29B9-4FBD-BC48-B2C0A9D963AA} 2011-05-16 12:14:57 ——– d—–w- C:\Users\Adam\AppData\Local\{FC86C94C-A3CB-4FB9-AA15-2D9D9BA46E6D} 2011-05-16 12:04:48 ——– d—–w- C:\Users\Adam\AppData\Local\{F594B575-DA6C-4866-8508-55EFC0CC1606} 2011-05-16 11:45:45 ——– d—–w- C:\Users\Adam\AppData\Local\{0AD7463D-3D29-43A6-8DFF-66CF23B3BF80} 2011-05-16 11:28:34 ——– d—–w- C:\Users\Adam\AppData\Local\{5564C8B7-922F-44AC-80B5-9BB11D14A602} 2011-05-15 16:28:38 ——– d—–w- C:\Users\Adam\AppData\Local\{37BDD0CC-5AF4-4C53-ABC1-BF9E3BBF40F9} 2011-05-14 16:44:24 ——– d—–w- C:\Users\Adam\AppData\Local\{AA76FAF5-EB31-4B99-89FD-8C02E6E687E1} 2011-05-14 04:03:36 ——– d—–w- C:\Users\Adam\AppData\Local\{8DD34EC0-165F-4960-B081-E11AF4F65B64} 2011-05-13 11:46:20 ——– d—–w- C:\Users\Adam\AppData\Local\{554B00C1-5BFB-484D-9805-E1988B980470} 2011-05-12 23:45:14 ——– d—–w- C:\Users\Adam\AppData\Local\{50D30C77-A892-4D6B-B973-D167D3D67EC2} 2011-05-12 11:44:30 ——– d—–w- C:\Users\Adam\AppData\Local\{D8467A09-B254-44F6-A529-B71F892C05D1} 2011-05-11 03:39:49 ——– d—–w- C:\Users\Adam\AppData\Local\{98D5C4C0-E01F-498A-A4B0-5CB9E002A14B} 2011-05-10 22:18:37 ——– d–h–w- C:\$AVG 2011-05-10 12:05:53 ——– d—–w- C:\Users\Adam\AppData\Local\Adobe 2011-05-10 11:52:13 ——– d—–w- C:\Users\Adam\AppData\Local\{A36E2118-7750-42CF-8181-E6865EACCC63} 2011-05-09 11:48:25 ——– d—–w- C:\Users\Adam\AppData\Local\{31CFE572-3D0F-4D95-B448-F04098FDF7EF} 2011-05-08 23:39:30 ——– d—–w- C:\Users\Adam\AppData\Local\{EA314C3C-92F2-43BD-9E20-00D9D2E570C5} 2011-05-07 17:51:52 ——– d—–w- C:\Users\Adam\AppData\Local\{75FD5B9D-6859-48CD-9072-371DA9525FB4} 2011-05-07 01:25:33 ——– d—–w- C:\Users\Adam\AppData\Local\{5BB41097-A6D6-4DE0-B6DF-C9AAA3E33A3C} 2011-05-06 00:43:43 ——– d—–w- C:\Users\Adam\AppData\Local\{5D313E83-5119-4C59-9632-CD5E53B83218} 2011-05-05 12:43:01 ——– d—–w- C:\Users\Adam\AppData\Local\{977CA249-3BD3-48F7-80C2-5DC21E43850D} 2011-05-04 21:15:29 ——– d—–w- C:\Users\Adam\AppData\Local\{7800E47B-6A27-4971-810D-78F3BA7EB139} 2011-05-03 23:40:43 ——– d—–w- C:\Users\Adam\AppData\Local\{C7117AAC-B36D-437D-AB99-1D0E5E30777B} 2011-05-03 11:39:39 ——– d—–w- C:\Users\Adam\AppData\Local\{64B920F2-C277-4425-8A3D-F2ED86570D11} 2011-05-02 12:07:43 ——– d—–w- C:\Users\Adam\AppData\Local\{474D2A31-401A-41F0-8A5E-8C3D9EBFBF14} 2011-05-02 01:44:02 ——– d—–w- C:\Users\Adam\AppData\Roaming\Avira 2011-05-02 01:35:55 83120 —-a-w- C:\Windows\System32\drivers\avgntflt.sys 2011-05-02 01:35:54 ——– d—–w- C:\Program Files (x86)\Avira 2011-05-02 01:35:54 ——– d—–w- C:\PROGRA~3\Avira 2011-05-01 19:41:07 ——– d—–w- C:\Users\Adam\AppData\Local\{B5C01810-2B84-4E48-8899-C4F915B39BE5} 2011-05-01 19:32:54 ——– d—–w- C:\Users\Adam\AppData\Local\LogMeIn Hamachi 2011-05-01 19:32:10 ——– d—–w- C:\Program Files (x86)\LogMeIn Hamachi 2011-05-01 17:58:36 ——– d—–w- C:\Users\Adam\AppData\Local\{EA2169FE-846B-4099-8693-0E8A2E15D1EA} 2011-05-01 01:38:41 ——– d—–w- C:\PROGRA~3\TorrentEasy 2011-05-01 00:37:42 ——– d—–w- C:\Windows\.jagex_cache_32 2011-04-30 18:46:38 ——– d—–w- C:\Users\Adam\AppData\Local\Deployment 2011-04-30 18:46:38 ——– d—–w- C:\Users\Adam\AppData\Local\Apps 2011-04-30 17:12:47 ——– d—–w- C:\Users\Adam\AppData\Local\{4B408698-0EEA-4D9D-A725-582E0CB7105E} 2011-04-29 21:47:14 ——– d—–w- C:\Users\Adam\AppData\Local\{955347A9-855F-4A92-855B-419FC3A35A71} 2011-04-29 09:46:29 ——– d—–w- C:\Users\Adam\AppData\Local\{B38FEF21-719A-4990-BD60-82CF7FC10EFB} 2011-04-28 12:55:05 ——– d—–w- C:\Users\Adam\AppData\Local\{5CB91DDF-EE99-4FED-B1F0-0D08F6B55EDF} 2011-04-27 23:23:25 ——– d—–w- C:\Users\Adam\AppData\Local\{76B0E6B8-3B2B-4C27-83C1-E76C430E3EEC} 2011-04-27 11:22:37 ——– d—–w- C:\Users\Adam\AppData\Local\{1F2C78B3-7D3E-40F8-98F2-A651D0B8AB50} 2011-04-26 21:11:31 2870272 —-a-w- C:\Windows\explorer.exe 2011-04-26 21:11:30 2614784 —-a-w- C:\Windows\SysWow64\explorer.exe 2011-04-26 20:58:05 31232 —-a-w- C:\Windows\SysWow64\prevhost.exe 2011-04-26 20:58:05 31232 —-a-w- C:\Windows\System32\prevhost.exe 2011-04-26 20:53:30 ——– d—–w- C:\Users\Adam\AppData\Local\{EAADC4B2-BA79-4372-86C1-091841E6C0E7} 2011-04-26 05:46:31 ——– d—–w- C:\Users\Adam\AppData\Local\{87D6317F-AAF8-42D3-A599-C6919D779875} 2011-04-25 17:45:51 ——– d—–w- C:\Users\Adam\AppData\Local\{61DE5419-B1A7-4067-B686-4432AAFDB4D3} 2011-04-25 05:17:27 ——– d—–w- C:\Users\Adam\AppData\Local\{81BD3831-4FB3-4EFB-AB28-045D0364AD6C} 2011-04-24 16:27:51 ——– d—–w- C:\Users\Adam\AppData\Local\{462451C0-5349-46F7-BB72-B7B869F07527} 2011-04-23 14:58:51 ——– d—–w- C:\Users\Adam\AppData\Local\{F3BE6964-1B3C-4B81-B2F9-7ACBD78F505B} 2011-04-22 17:50:26 ——– d—–w- C:\Users\Adam\AppData\Local\{98B1EC4B-CF3D-44EE-B8DC-E066C9C83770} 2011-04-22 00:18:55 ——– d—–w- C:\Users\Adam\AppData\Local\{B58E1573-39D5-438D-AEA0-E5390C2177A7} 2011-04-21 12:18:11 ——– d—–w- C:\Users\Adam\AppData\Local\{F2663E1B-E154-4FE9-A4B1-5FE6F42B695B} 2011-04-20 12:27:17 ——– d—–w- C:\Users\Adam\AppData\Local\{4CEB4D9D-A794-4A6C-8001-D153214DB863} 2011-04-19 22:07:20 ——– d—–w- C:\PROGRA~3\Symantec 2011-04-19 22:07:16 ——– d—–w- C:\Windows\System32\drivers\NSSx64\0300000.067 2011-04-19 22:07:16 ——– d—–w- C:\Windows\System32\drivers\NSSx64 2011-04-19 22:07:16 ——– d—–w- C:\Program Files (x86)\Norton Security Scan 2011-04-19 22:07:15 ——– d—–w- C:\PROGRA~3\Norton 2011-04-19 22:07:14 ——– d—–w- C:\Program Files (x86)\NortonInstaller 2011-04-19 22:07:14 ——– d—–w- C:\PROGRA~3\NortonInstaller 2011-04-19 22:06:59 ——– d—–w- C:\Program Files (x86)\Audacity 2011-04-19 22:05:42 ——– d—–w- C:\Program Files (x86)\Yontoo Layers Client 2011-04-19 22:05:42 ——– d—–w- C:\PROGRA~3\Tarma Installer . ==================== Find3M ==================== . 2011-04-01 13:39:36 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-03-12 12:03:46 662528 —-a-w- C:\Windows\System32\XpsPrint.dll 2011-03-12 11:31:58 442880 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2011-03-11 06:23:13 187264 —-a-w- C:\Windows\System32\drivers\storport.sys 2011-03-11 06:23:06 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys 2011-03-11 06:23:06 1657216 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2011-03-11 06:23:06 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys 2011-03-11 06:23:00 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys 2011-03-11 06:22:41 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys 2011-03-11 06:22:40 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys 2011-03-11 06:19:26 1395712 —-a-w- C:\Windows\System32\mfc42.dll 2011-03-11 06:19:26 1359872 —-a-w- C:\Windows\System32\mfc42u.dll 2011-03-11 06:18:20 2566144 —-a-w- C:\Windows\System32\esent.dll 2011-03-11 06:15:54 96768 —-a-w- C:\Windows\System32\fsutil.exe 2011-03-11 05:40:24 1164288 —-a-w- C:\Windows\SysWow64\mfc42u.dll 2011-03-11 05:40:24 1137664 —-a-w- C:\Windows\SysWow64\mfc42.dll 2011-03-11 05:39:35 1686016 —-a-w- C:\Windows\SysWow64\esent.dll 2011-03-11 05:37:34 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe 2011-03-08 06:14:30 976896 —-a-w- C:\Windows\System32\inetcomm.dll 2011-03-08 05:38:13 740864 —-a-w- C:\Windows\SysWow64\inetcomm.dll 2011-03-04 06:17:25 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2011-03-04 06:17:24 347648 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2011-03-03 06:17:10 182272 —-a-w- C:\Windows\System32\dnsrslvr.dll 2011-03-03 06:14:38 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe 2011-03-03 05:27:30 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-03-03 03:58:32 3133440 —-a-w- C:\Windows\System32\win32k.sys 2011-02-24 06:30:00 476160 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2011-02-24 06:29:15 1197056 —-a-w- C:\Windows\System32\wininet.dll 2011-02-24 06:24:57 57856 —-a-w- C:\Windows\System32\licmgr10.dll 2011-02-24 05:32:52 288256 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2011-02-24 05:32:44 981504 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-02-24 05:30:16 44544 —-a-w- C:\Windows\SysWow64\licmgr10.dll 2011-02-24 05:05:13 482816 —-a-w- C:\Windows\System32\html.iec 2011-02-24 04:24:04 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-02-24 04:23:48 386048 —-a-w- C:\Windows\SysWow64\html.iec 2011-02-24 03:50:26 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-02-23 14:04:21 40648 —-a-w- C:\Windows\avastSS.scr 2011-02-23 13:57:01 505176 —-a-w- C:\Windows\System32\drivers\aswSnx.sys 2011-02-23 13:55:05 64344 —-a-w- C:\Windows\System32\drivers\aswMonFlt.sys 2011-02-23 05:16:28 461312 —-a-w- C:\Windows\System32\drivers\srv.sys 2011-02-23 05:16:01 401920 —-a-w- C:\Windows\System32\drivers\srv2.sys 2011-02-23 05:15:50 161792 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2011-02-23 05:15:27 157696 —-a-w- C:\Windows\System32\drivers\mrxsmb.sys 2011-02-23 05:15:14 286720 —-a-w- C:\Windows\System32\drivers\mrxsmb10.sys 2011-02-23 05:15:13 126464 —-a-w- C:\Windows\System32\drivers\mrxsmb20.sys 2011-02-23 05:15:06 90624 —-a-w- C:\Windows\System32\drivers\bowser.sys 2011-02-19 06:37:44 1135104 —-a-w- C:\Windows\System32\FntCache.dll 2011-02-19 06:37:10 1540608 —-a-w- C:\Windows\System32\DWrite.dll 2011-02-19 06:36:49 902656 —-a-w- C:\Windows\System32\d2d1.dll 2011-02-19 06:36:13 46080 —-a-w- C:\Windows\System32\atmlib.dll 2011-02-19 05:32:48 1074176 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-02-19 05:32:35 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-02-19 05:32:08 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2011-02-19 04:13:39 367104 —-a-w- C:\Windows\System32\atmfd.dll 2011-02-19 03:37:02 294912 —-a-w- C:\Windows\SysWow64\atmfd.dll 2011-02-18 21:36:58 51712 —-a-w- C:\Windows\System32\drivers\usbaapl64.sys 2011-02-18 21:36:58 4184352 —-a-w- C:\Windows\System32\usbaaplrc.dll 2011-02-18 06:37:05 612352 —-a-w- C:\Windows\System32\vbscript.dll 2011-02-18 05:36:26 428032 —-a-w- C:\Windows\SysWow64\vbscript.dll . ============= FINISH: 21:58:50.52 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 12/31/2010 1:03:49 PM System Uptime: 5/18/2011 9:40:31 PM (0 hours ago) . Motherboard: ASUSTeK Computer INC. | | M4N68T-M-V2 Processor: AMD Athlon™ II X2 250 Processor | AM3 | 3000/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 466 GiB total, 317.482 GiB free. D: is CDROM (CDFS) E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP313: 5/9/2011 6:51:25 AM - Windows Update RP314: 5/9/2011 4:41:09 PM - Windows Update RP315: 5/9/2011 5:14:40 PM - Installed Adobe Reader X. RP316: 5/10/2011 6:49:42 AM - Windows Update RP317: 5/11/2011 7:38:20 AM - Windows Update RP318: 5/12/2011 3:00:11 AM - Windows Update RP319: 5/13/2011 6:44:09 AM - Windows Update RP320: 5/14/2011 11:46:51 AM - Windows Update RP321: 5/15/2011 3:00:11 AM - Windows Update RP322: 5/15/2011 11:22:45 PM - Removed LogMeIn Hamachi RP323: 5/15/2011 11:24:02 PM - Removed AVG 2011 RP324: 5/17/2011 4:53:30 PM - Windows Update RP325: 5/18/2011 4:00:43 PM - Windows Update RP326: 5/18/2011 9:44:29 PM - Windows Update . ==== Installed Programs ====================== . µTorrent Acoustica Effects Pack Acoustica Mixcraft 5 Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader X (10.0.1) Apple Application Support Apple Software Update ATI Catalyst Registration Audacity 1.2.6 avast! Free Antivirus Avira AntiVir Premium Borderlands Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy ccc-core-static CCC Help English Conduit Engine Curse Client D3DX10 Far Cry 2 free-downloads.net Toolbar Google Chrome Guitar Pro 5.0 Guitar Pro 6 Demo Java Auto Updater Java™ 6 Update 24 Junk Mail filter update League of Legends Left 4 Dead 2 LogMeIn Hamachi Malwarebytes' Anti-Malware McAfee Security Scan Plus Mesh Runtime Messenger Companion Microsoft Office 2010 Microsoft Office Click-to-Run 2010 Microsoft Office Starter 2010 - English Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox (3.6.15) MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML4 Parser Norton Security Scan NVIDIA PhysX v8.10.29 Pando Media Booster Platform PunkBuster Services QuickTime RIFT Rise of Nations Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Steam The Lord of the Rings FREE Trial Torchlight TuxGuitar Update for Microsoft .NET Framework 4 Client Profile (KB2473228) uTorrentBar Toolbar Ventrilo Client VIA Platform Device Manager Visual Studio 2008 x64 Redistributables Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live Messenger Companion Core Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources World of Warcraft Public Test . ==== Event Viewer Messages From Past Week ======== . 5/18/2011 9:41:11 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start. 5/18/2011 9:41:11 PM, Error: Service Control Manager [7001] - The Avira AntiVir WebGuard service depends on the Avira AntiVir Guard service which failed to start because of the following error: The operation completed successfully. 5/18/2011 9:41:11 PM, Error: Service Control Manager [7001] - The Avira AntiVir MailGuard service depends on the Avira AntiVir Guard service which failed to start because of the following error: The operation completed successfully. 5/18/2011 9:41:11 PM, Error: Service Control Manager [7001] - The Application Virtualization Client service depends on the Application Virtualization Service Agent service which failed to start because of the following error: This version of Application Virtualization Client is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need a x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher. 5/18/2011 9:41:10 PM, Error: Service Control Manager [7000] - The Application Virtualization Service Agent service failed to start due to the following error: This version of Application Virtualization Service Agent is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need a x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher. 5/18/2011 9:38:26 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 5/18/2011 6:37:53 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BITS service. 5/18/2011 6:37:53 AM, Error: Service Control Manager [7000] - The Background Intelligent Transfer Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 5/18/2011 4:40:44 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start. 5/18/2011 4:40:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 5/18/2011 4:40:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 5/18/2011 4:40:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 5/18/2011 4:40:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 5/18/2011 4:39:33 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi Avgldx64 Avgmfx64 avipbb discache spldr sptd Wanarpv6 5/18/2011 4:39:10 PM, Error: sptd [4] - Driver detected an internal error in its data structures for . 5/18/2011 4:27:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 5/17/2011 11:34:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097} 5/16/2011 9:30:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AVG WatchDog service to connect. 5/16/2011 9:30:58 PM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 5/16/2011 9:26:28 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Browser service. 5/16/2011 9:26:28 PM, Error: Service Control Manager [7000] - The Computer Browser service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 5/16/2011 6:47:32 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wlidsvc service. 5/16/2011 5:33:31 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect. 5/16/2011 5:33:31 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 5/16/2011 5:33:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 5/16/2011 5:04:12 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:04:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 5/16/2011 5:04:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 5/16/2011 5:03:28 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswRdr aswSnx aswSP aswTdi Avgldx64 Avgmfx64 Avgtdia avipbb DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr sptd tdx Wanarpv6 WfpLwf ws2ifsl 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 5/16/2011 5:03:28 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 5/16/2011 12:29:59 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service. 5/16/2011 12:29:29 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WMPNetworkSvc service. 5/15/2011 3:00:43 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft Office 2010 (KB2077208). . ==== End Of File ===========================
Post #4
Now I can see both Avast and Avira AntiVir on the machine. I would recommend removing one of these. You can still get conflicts even when only one is enabled.
If you choose to remove Avast, you can use the link I posted previously. If you want to remove Avira, just go to Control Panel > Programs and Features and uninstall it normally.



I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.
  • Click on the tab labeled Update and then click on the button Check for updates.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.



http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Unheck Remove found threats.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.
Post #5
This is from MWB, doing the ESET thing now. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6612 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 5/18/2011 10:36:52 PM mbam-log-2011-05-18 (22-36-52).txt Scan type: Quick scan Objects scanned: 160659 Time elapsed: 3 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Users\Adam\AppData\Local\Temp\RarSFX0\KMS\KMS.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
Post #6
ESET log ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=29c1f93f29bcc74bbd4c29d89fa74095 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-05-19 04:59:08 # local_time=2011-05-18 11:59:08 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1032 16777214 0 1 0 0 0 0 # compatibility_mode=1792 16777215 100 0 555937 555937 0 0 # compatibility_mode=5893 16776574 100 94 3394474 57321141 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=186214 # found=2 # cleaned=0 # scan_time=3458 C:\ProgramData\TorrentEasy\extensions.exe a variant of Win32/Adware.GoodMedia.C application (unable to clean) 00000000000000000000000000000000 I C:\Users\All Users\TorrentEasy\extensions.exe a variant of Win32/Adware.GoodMedia.C application (unable to clean) 00000000000000000000000000000000 I
Post #7
We're going to use a different tool to remove those malware items. Since this tool can scan and fix - let's get a scan first and then we'll use it to fix the issues. Stick with me a little longer - we are almost done :)



OTL Custom Scan

  • Download OTL to your desktop.
  • Right-click and choose Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #8
Are you having any trouble with the last set of instructions? Reminder: Topics with no reply in 3 days will be closed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI